Integrate staff OIDC/MFA login, session lifecycle, and break-glass recovery

[alexeygrigorev]

Parent epic: #7

Normative specs: 06 — Authentication, 07 — Identity
Decision dependency: #20

Scope

Integrate the selected OIDC provider for human Studio login with provider-enforced MFA evidence, exact issuer/client/callback/claim validation, verified-email account linking, group mapping/provisioning policy, secure sessions with idle/absolute expiry/revocation, login throttling/logout/offboarding, active-staff check, provider-outage behavior, and separately protected local break-glass recovery/rotation/exercise.

Non-goals

No generic social login for learners unless required by copied course compatibility, no local staff passwords for routine use, and no role authorization based only on OIDC authentication.

Acceptance criteria

• Provider/claims/MFA/environment configuration follows approved Decision: Select the staff OIDC provider and break-glass policy #20 decision and secrets never enter DB exports/logs.
• State/nonce/PKCE/callback/issuer/audience/signature/time checks and safe account linking pass.
• Staff disable/role removal/session revoke takes effect within approved bound.
• Cookies/CSRF/fixation/idle/absolute timeout/logout/throttling/no-store behavior pass.
• Break-glass access is narrow, monitored, rotated, documented, and successfully exercised.
• Provider failure denies new login without breaking public reads and has operator-visible alert/runbook.

Test scenarios

1. Valid login, missing MFA/claim, bad state/nonce/aud/issuer/signature, replay, expired token, duplicate email/account conflict.
2. Disable/role change/revocation during active session, idle/absolute timeout, session fixation, CSRF, logout/back.
3. Provider outage and break-glass drill with audit/redaction.

Playwright

Use a deterministic OIDC test provider to exercise login/callback, denied MFA, role navigation, session expiry/logout; manually verify real provider and break-glass criteria [HUMAN]; capture screenshots without tokens.

Dependencies

Depends on #20, #32, and #63 security controls. Real environment verification depends on #70.